REVIEW 3 major objections 6 minor 37 references
When Data-Free Knowledge Distillation Meets Non-Transferable Teacher: Escaping Out-of-Distribution Trap is All You Need
T0 review · 3 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash
Pith's one-line read The paper claims non-transferable teachers poison data-free distillation with OOD knowledge, and a PGD robustness split lets students keep ID knowledge while unlearning that trap.
desk verdict A solid empirical paper that identifies a real failure mode in DFKD with NTL teachers and offers a workable defense, but it overstates ID gains and leaves the central grouping mechanism under-validated. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central mechanism is the ID/OOD adversarial robustness gap of NTL teachers, operationalized by a label-change criterion: a synthetic sample is called ID-like (fragile) if an untargeted PGD attack within an $\ell_p$ ball of radius $\epsilon$ changes the teacher's predicted label, and OOD-like (robust) if the label is unchanged. Two losses then carry the argument: a calibrated knowledge distillation loss $L_{\mathrm{ckd}}$ on the fragile group, and a maximized forgetting term $L_{\mathrm{forget}}$ on the robust group, combined as $L_{\mathrm{ATEsc}} = L_{\mathrm{ckd}} - \min(1, \lambda L_{\mathrm{forget}})$. This turns the teacher's own decision-boundary geometry into a domain classifier for synthetic data.
What would settle it
Train an NTL teacher on a domain pair where OOD samples sit close to decision boundaries, or adversarially train the teacher on the ID domain to close the robustness gap, then run ATEsc with a fixed epsilon: if the label-change split no longer yields a fragile group enriched in real ID samples and a robust group enriched in OOD samples, or if ID accuracy stops improving while OOD accuracy stays high, the robustness-gap premise fails.
Extended reading notes
Core claim
NTL teachers impose an OOD trap on data-free knowledge distillation: because the teacher was trained to push OOD-domain features far from ID features, the generator's adversarial exploration and batch-normalization statistics matching make it synthesize OOD-like samples that activate the teacher's misleading OOD outputs. The student then mimics those outputs, so it inherits OOD behavior and its ID accuracy collapses. The paper's central claim is that this trap can be escaped without any real data by exploiting the same geometry that created it: NTL teachers are adversarially fragile on ID data but robust on OOD data. ATEsc runs an untargeted PGD attack on each synthetic sample and sorts samples by whether the predicted label changes; the label-changing (fragile) group is used for standard KL distillation, and the label-stable (robust) group is used as a negative set whose teacher outputs the student is trained to diverge from. The paper shows this split filters synthetic distributions back toward the ID domain and reduces inherited OOD accuracy and attack success rates across close-set, open-set, and backdoor configurations.
Load-bearing premise
The load-bearing premise is that a fixed-epsilon untargeted PGD attack on synthetic samples reliably flags exactly the samples whose teacher predictions are ID knowledge rather than OOD knowledge, i.e., that the NTL teacher's ID/OOD robustness gap persists on synthetic data throughout training.
Editorial extensions
If this is right
- Data-free distillation students can safely learn from non-transferable teachers, recovering near-teacher ID accuracy instead of random-guess or OOD-mimicking behavior.
- The forgetting term suppresses backdoor transfer: in NTL-based backdoor settings, attack success rates drop substantially compared with the original baselines and with the distillation-only variant.
- The method is plug-and-play: any adversarial-exploration DFKD baseline can add ATEsc by changing only the distillation loss applied after the generator update.
- Because it relies only on the teacher and generated samples, the defense requires no access to real ID or OOD data, preserving the data-free setting.
- Non-transferable learning becomes less reliable as a model-extraction defense, since an attacker with only a generator can reclaim ID knowledge; this IP-protection concern is noted in the paper itself.
Reading between the lines
- Inference: the same robustness-gap principle may generalize beyond NTL teachers to any teacher whose decision-boundary geometry encodes domain membership, including conventionally backdoored teachers where trigger-domain samples are unusually robust.
- Inference: practical use of ATEsc will require per-task selection of the perturbation bound $\epsilon$, since the paper's own sensitivity analysis shows that too small an $\epsilon$ weakens the fragile/robust separation.
- Inference: an adversarial arms race is implied: an NTL teacher trained to be adversarially robust on ID or fragile on OOD would close the gap that the grouping exploits, and the paper offers no theoretical guarantee against that.
- Inference: the maximized forgetting term could serve as a general student-side unlearning primitive for synthetic data whenever the teacher is suspected of encoding undesired domain knowledge.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper studies data-free knowledge distillation (DFKD) from non-transferable learning (NTL) teachers, i.e., teachers trained so that knowledge transfer from an in-distribution (ID) domain to an out-of-distribution (OOD) domain is deliberately restricted. The authors identify an 'OOD trap': when distilling NTL teachers, the generator produces synthetic samples that mix ID and OOD content, the student learns misleading OOD knowledge, and ID accuracy suffers. They propose Adversarial Trap Escaping (ATEsc), a plug-and-play module that splits each synthetic batch by PGD-based label-flip robustness: fragile samples are treated as ID-like and used for knowledge distillation, while robust samples are treated as OOD-like and used as negative examples for a forgetting term. Experiments cover close-set NTL, open-set NTL, and NTL-based backdoor settings across three DFKD baselines and multiple architectures. The results show that calibrated distillation (+CKD) usually improves ID accuracy, and the full ATEsc additionally reduces OOD transfer/ASR, although often at the cost of ID accuracy relative to +CKD.
Significance. If the proposed mechanism is validated, this is a useful contribution: it is the first systematic study of DFKD from NTL teachers, it identifies a concrete and reproducible failure mode (the OOD trap), and it offers a simple plug-and-play remedy that works across several baselines and settings. The adversarial-robustness-based grouping is a clever, falsifiable hypothesis, and the paper provides extensive experiments, toy illustrations, and released code. However, the evidence for the specific domain-based mechanism is incomplete: the grouping rule in Eq. (11) is never directly validated against ground-truth domain membership on synthetic samples, and the abstract overstates the ID-performance benefit, since the forgetting term frequently lowers ID accuracy relative to CKD alone. The significance of the paper therefore depends on additional experiments that separate the proposed domain-filtering explanation from low-confidence/low-quality filtering.
major comments (3)
- [Abstract; Section 5.2; Tables 1 and 2] The abstract states that ATEsc 'significantly enhanc[es] the student's ID performance while effectively suppressing the transfer of misleading OOD knowledge', but the tables do not support the first half when ATEsc is compared with +CKD. For example, Table 2 shows DFQ SVHN→CIFAR10 IAcc dropping from 89.0 to 88.1, NAYER SVHN→CIFAR10 dropping from 91.2 to 89.2, and DFQ CIFAR10→Digits dropping from 68.5 to 60.3; Table 1 shows CMI SVHN→MNIST-M dropping from 89.8 to 58.7. Section 5.2 itself concedes that ATEsc 'also sacrify some ID performance.' The defensible claim is that CKD improves ID transfer while the forgetting term trades ID accuracy for lower OOD transfer/ASR; the abstract and contribution bullets should be reworded accordingly.
- [Section 4.2, Eq. (11); Appendix C.5; Appendix E.7] The central grouping criterion is not validated as a domain classifier on synthetic data. Appendix C.5 establishes that real ID and real OOD samples differ in PGD robustness, and Appendix E.7 shows t-SNE alignment, but no experiment measures the agreement between Eq. (11)'s fragile/robust assignment and a ground-truth domain label for synthetic samples. Because synthetic samples have no known domain label, the observed improvements could come from removing low-confidence or low-quality samples rather than OOD-like ones. The ID drops when the forgetting term is added (e.g., Table 2: CMI SVHN→CIFAR10 91.3→72.0; NAYER CIFAR10→Digits 61.2→59.0) are exactly the signature expected if the robust group contains nontrivial ID-like content. Please add a controlled test that compares Eq. (11) against an entropy/confidence filter on the same synthetic batches, or that measures precision on synthetic samples of known provenance, to establish that domain, not sample quality, drives the gains.
- [Appendix E.2; Section 4.2] The perturbation bound epsilon is load-bearing for the method, yet the main text does not report the value used for Tables 1–3. Appendix E.2 shows that for DFQ+ATEsc on CIFAR10→STL10, decreasing epsilon causes a large drop in OAcc (Figure 41), and for CIFAR10→Digits, larger epsilon monotonically improves OOD resistance (Figure 42). Since Eq. (11) partitions samples by exactly this threshold, the paper should state the default epsilon, report the sweep for all main configurations, and either justify a single value or show that the main conclusions are stable over a range.
minor comments (6)
- [Abstract] The abstract contains grammatical errors: 'without access the real in-distribution data' and 'NTL teachers fool DFKD through divert the generator's attention' should be rewritten.
- [Section 5.2] The phrase 'it also sacrify some ID performance' is a typo; it should read 'it also sacrifices some ID performance.'
- [Table 3] Several ATEsc cells have very large standard deviations, e.g., NAYER + ATEsc on BadNet(sq) reports ASR 34.6±47.3. The paper should discuss whether these differences are statistically meaningful, since the interval spans nearly the full range of the baseline.
- [Section 5.1] For close-set NTL, higher OOD accuracy is interpreted as 'better resistance to misleading OOD knowledge transfer,' but since ID and OOD share the label space, OOD accuracy under true labels could also be read as beneficial generalization. This conflation should be clarified when the metric is introduced.
- [Appendix E.1] The implementation details do not state the number of random seeds used for the reported means and standard deviations; this information should be added.
- [Figure 1] The y-axis labels in Figures 1(c)–(e) appear as concatenated numbers without separators (e.g., '1316191121'); they should be formatted as a normal tick sequence.
Circularity Check
No significant circularity: ATEsc's robustness-based grouping is not fitted to its target IAcc/ASR metrics, and the central mechanism is validated on held-out real ID/OOD data rather than defined by the reported results.
full rationale
The paper's central claim—that NTL teachers impose an OOD trap on DFKD and that filtering synthetic samples by PGD label-flip robustness helps escape it—does not reduce by construction to its own outputs. The grouping criterion in Eq. 11 uses only the teacher's prediction change under PGD; it does not use student ID accuracy, OOD accuracy, or attack success rate. The premise that NTL teachers are fragile on real ID data and robust on real OOD data is established independently on held-out real samples (Fig. 6 and Appendices C.5–C.7), with additional ablations on NTL training objectives (Appendix C.6), rather than being inferred from the final student metrics. The calibrated KD loss (Eq. 12) and forgetting loss (Eq. 13) are optimization objectives evaluated externally on real test sets, not fitted predictors of those test metrics. Self-citations to prior NTL work by the same group appear in background and related-work discussions (e.g., Hong et al. 2024a,b; Hong et al. 2025), but no load-bearing uniqueness theorem or ansatz is imported from those citations; the core NTL formulation is cited to Wang et al. 2022. The skeptical concern that Eq. 11 is not directly validated against ground-truth domain labels on synthetic samples is a legitimate empirical-validation and possible-confound issue, but it is not an instance of a prediction being equivalent to its input by definition. Therefore no circular step is established, and the appropriate circularity score is 0.
Assumptions & free parameters
free parameters (3)
- epsilon (adversarial perturbation bound) =
not specified in main text; varied in Appendix E.2 (e.g., 4, 8, 16)
- lambda (forgetting loss weight) =
not specified in main text; varied in Appendix E.3 from 1e-7 to 1e-2
- PGD attack steps =
not specified in main text; figures show 0-5 steps
assumptions (3)
- domain assumption OOD-domain samples are far from decision boundaries because NTL training maximizes output and feature discrepancy (Eqs. 2-3), making them adversarially robust.
- domain assumption Synthetic samples whose predicted label changes under untargeted PGD are ID-like; samples whose label remains stable are OOD-like.
- domain assumption The BatchNorm statistics of an NTL teacher are a mixture of ID and OOD distributions, and the BN loss in DFKD pulls the generator toward OOD-like samples.
Cite this review
Pith. "Pith review of When Data-Free Knowledge Distillation Meets Non-Transferable Teacher: Escaping Out-of-Distribution Trap is All You Need." pith.science (2026). https://pith.science/paper/HI4236PB
@misc{pith2026250704119,
author = {Pith},
title = {Pith review of: When Data-Free Knowledge Distillation Meets Non-Transferable Teacher: Escaping Out-of-Distribution Trap is All You Need},
year = {2026},
howpublished = {\url{https://pith.science/paper/HI4236PB}},
note = {Machine review of arXiv:2507.04119}
}
read the original abstract
Data-free knowledge distillation (DFKD) transfers knowledge from a teacher to a student without access the real in-distribution (ID) data. Its common solution is to use a generator to synthesize fake data and use them as a substitute for real ID data. However, existing works typically assume teachers are trustworthy, leaving the robustness and security of DFKD from untrusted teachers largely unexplored. In this work, we conduct the first investigation into distilling non-transferable learning (NTL) teachers using DFKD, where the transferability from an ID domain to an out-of-distribution (OOD) domain is prohibited. We find that NTL teachers fool DFKD through divert the generator's attention from the useful ID knowledge to the misleading OOD knowledge. This hinders ID knowledge transfer but prioritizes OOD knowledge transfer. To mitigate this issue, we propose Adversarial Trap Escaping (ATEsc) to benefit DFKD by identifying and filtering out OOD-like synthetic samples. Specifically, inspired by the evidence that NTL teachers show stronger adversarial robustness on OOD samples than ID samples, we split synthetic samples into two groups according to their robustness. The fragile group is treated as ID-like data and used for normal knowledge distillation, while the robust group is seen as OOD-like data and utilized for forgetting OOD knowledge. Extensive experiments demonstrate the effectiveness of ATEsc for improving DFKD against NTL teachers. Code is released at https://github.com/tmllab/2025_ICML_ATEsc.
Figures
Figures from the paper (46 more)
Reference graph
Works this paper leans on
-
[1]
A new backdoor attack in cnns by training set corruption without label poison- ing
Barni, M., Kallas, K., and Tondi, B. A new backdoor attack in cnns by training set corruption without label poison- ing. In 2019 IEEE International Conference on Image Processing (ICIP), pp. 101–105. IEEE,
work page 2019
-
[3]
Considering that the adaptive backdoor attack in Qi et al
Compared to using CKD alone, our full ATEsc (i.e., CKD+Lforget) achieves a significantly lower ASR. Considering that the adaptive backdoor attack in Qi et al. (2023) still uses the original standard trigger during test time to activate the backdoor, our results already show its effectiveness against the adaptive backdoor attack (Qi et al.,
work page 2023
-
[4]
Sophon: Non-fine-tunable learning to restrain task transferability for pre-trained models
Deng, J., Pang, S., Chen, Y ., Xia, L., Bai, Y ., Weng, H., and Xu, W. Sophon: Non-fine-tunable learning to restrain task transferability for pre-trained models. In 2024 IEEE Symposium on Security and Privacy (SP), pp. 2553–2571. IEEE,
work page 2024
-
[7]
constraint the G to: (i) follow the statistics of NTL teacher’s training data (i.e., a mixture of real ID and OOD domains), and (ii) maximize the discrepancy between the student S and the NTL teacher. As a result, the generator G is trained to synthesize both ID-like and OOD-like samples (i.e., ID-to-OOD synthetic distribution shift). When all these synth...
work page 2019
-
[9]
We report the ID domain accuracy (IAcc) in blue and OOD domain accuracy (OAcc) in red
Results on variants of NTL teachers. We report the ID domain accuracy (IAcc) in blue and OOD domain accuracy (OAcc) in red. SL NTL-cls NTL SL2domain NTL w/o MMD NTL w/o KL IAcc ↑ OAcc ↑ IAcc ↑ OAcc ↑ IAcc ↑ OAcc ↑ IAcc ↑ OAcc ↑ IAcc ↑ OAcc ↑ IAcc ↑ OAcc ↑ Teacher 99.44% 65.67% 99.22% 34.78% 99.11% 34.78% 99.67% 34.78% 99.56% 34.78% 99.56% 34.78% Student 9...
work page 2012
-
[10]
Adversarial attacks on neural network policies
Huang, S., Papernot, N., Goodfellow, I., Duan, Y ., and Abbeel, P. Adversarial attacks on neural network policies. arXiv preprint arXiv:1702.02284,
-
[12]
Enhancing the reliability of out-of-distribution image detection in neural networks
Liang, S., Li, Y ., and Srikant, R. Enhancing the reliability of out-of-distribution image detection in neural networks. arXiv preprint arXiv:1706.02690,
-
[14]
Towards deep learning models resistant to adver- sarial attacks
Madry, A. Towards deep learning models resistant to adver- sarial attacks. arXiv preprint arXiv:1706.06083,
Show all 37 references
-
[15]
Effects of degradations on deep neural network architectures
Roy, P., Ghosh, S., Bhattacharya, S., and Pal, U. Effects of degradations on deep neural network architectures. arXiv preprint arXiv:1807.10108,
-
[16]
Very deep convolutional networks for large- scale image recognition
Simonyan, K. Very deep convolutional networks for large- scale image recognition. arXiv preprint arXiv:1409.1556,
-
[17]
Task groupings regularization: Data-free meta- learning with heterogeneous pre-trained models
Wei, Y ., Hu, Z., Shen, L., Wang, Z., Li, Y ., Yuan, C., and Tao, D. Task groupings regularization: Data-free meta- learning with heterogeneous pre-trained models. arXiv preprint arXiv:2405.16560,
-
[18]
Jail- breaking the non-transferable barrier via test-time data disguising
12 When Data-Free Knowledge Distillation Meets Non-Transferable Teacher: Escaping Out-of-Distribution Trap is All You Need Xiang, Y ., Hong, Z., Yao, L., Wang, D., and Liu, T. Jail- breaking the non-transferable barrier via test-time data disguising. arXiv preprint arXiv:2503.17198,
-
[20]
Representation surgery for multi-task model merging
Yang, E., Shen, L., Wang, Z., Guo, G., Chen, X., Wang, X., and Tao, D. Representation surgery for multi-task model merging. arXiv preprint arXiv:2402.02705,
-
[21]
and Lu, W
Zeng, G. and Lu, W. Unsupervised non-transferable text classification. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing (EMNLP),
2022
-
[22]
Understanding the interaction of adversarial training with noisy labels.arXiv preprint arXiv:2102.03482, 2021a
Zhu, J., Zhang, J., Han, B., Liu, T., Niu, G., Yang, H., Kankanhalli, M., and Sugiyama, M. Understanding the interaction of adversarial training with noisy labels.arXiv preprint arXiv:2102.03482, 2021a. Zhu, Z., Hong, J., and Zhou, J. Data-free knowledge distil- lation for het...
2019 arXiv
-
[23]
The former one faces efficiency issues due to per-image optimization, and the latter one needs extra data
under the guidance of a teacher, or leverage unlabeled data from the wild (Fang et al., 2021a). The former one faces efficiency issues due to per-image optimization, and the latter one needs extra data. Generative Adversarial Networks (GANs)-based framework become the mainstre...
2019
-
[24]
However, only using adversarial exploration can bring non-stationary distribution problem and loss the diversity of synthesizing
primarily rely on the adversarial exploration. However, only using adversarial exploration can bring non-stationary distribution problem and loss the diversity of synthesizing. The non-stationary distribution problem causes the catastrophic forgetting of the student models. Th...
2023
-
[25]
This indicates that these samples are more similar to real OOD samples and can activate NTL teacher’s OOD misleading knowledge
We observe that for more advanced DFKD methods such as DFQ (Choi et al., 2020), CMI (Fang et al., 2021b), and NAYER (Tran et al., 2024), parts of synthetic samples’s features overlap with real OOD domain features. This indicates that these samples are more similar to real OOD ...
2020
-
[26]
In DFKD, SOTA methods such as Choi et al
for the identified OOD trap effect from NTL teachers to DFKD. In DFKD, SOTA methods such as Choi et al. (2020); Fang et al. (2021b); Tran et al. (2024) commonly use BN loss (Equation
2020
-
[28]
The NTL teacher is trained on CIFAR10→STL10 with VGG-13
Adversarial robustness (PGD) on ID and OOD domain. The NTL teacher is trained on CIFAR10→STL10 with VGG-13. C.6. The Influence of NTL Training Objectives to Adversarial Robustness In this section, we further investigate the influence of each training objective in NTL to the ad...
2022
-
[29]
This is because learning correct classification results in relatively complex decision boundaries between classes and small margins6 for ID domain data points
We have: • (i) The vanilla SL models are fragile on both ID and OOD domain. This is because learning correct classification results in relatively complex decision boundaries between classes and small margins6 for ID domain data points. • (ii) For the ID-domain SL with class co...
2022
-
[31]
We follow the implementation of DFQ and CMI in https://github.com/zju-vipa/CMI and NAYER in https://github.com/tmtuan1307/NAYER
and two memory bank methods: CMI (Fang et al., 2021b), NAYER (Tran et al., 2024). We follow the implementation of DFQ and CMI in https://github.com/zju-vipa/CMI and NAYER in https://github.com/tmtuan1307/NAYER. For each baseline, we evaluate two variants of our method: using o...
2024
-
[32]
We report the ID domain accuracy in blue and OOD domain accuracy in red
Different adversarial attack. We report the ID domain accuracy in blue and OOD domain accuracy in red. Results from the DFKD baselines are highlighted with gray rows. The accuracy drop compared to the pre-trained model is shown in brackets. Close-set NTL Open-set NTL ID: CIFAR...
2023
-
[33]
We report the ID domain accuracy in blue and OOD domain accuracy in red
Experiments on more backbones. We report the ID domain accuracy in blue and OOD domain accuracy in red. Results from the DFKD baselines are highlighted with gray rows. The accuracy drop compared to the pre-trained model is shown in brackets. ID: CIFAR10 OOD: STL ID: CIFAR10 OO...
-
[36]
Our work explores the DFKD under NTL teachers
to disentangle the student model from the impact of such shifts. Our work explores the DFKD under NTL teachers. We find that NTL teachers (pretrained on an ID domain and an OOD domain) result in OOD trap effect for DFKD. One key reason is the ID-to-OOD synthetic distribution s...
2023
-
[49]
T : ResNet34 and S: ResNet18)
Comparison of synthetic samples (CMI on NTL CIFAR10→Sig. T : ResNet34 and S: ResNet18). 35 When Data-Free Knowledge Distillation Meets Non-Transferable Teacher: Escaping Out-of-Distribution Trap is All You Need F. Further Discussion F.1. Distribution Shift in DFKD There are so...
2022
-
[2011]
T., Leman, K., and Mi- tra, T
Binici, K., Aggarwal, S., Pham, N. T., Leman, K., and Mi- tra, T. Robust and resource-efficient data-free knowledge distillation by generative pseudo replay. In Proceedings of the AAAI Conference on Artificial Intelligence , vol- ume 36, pp. 6089–6096, 2022a. Binici, K., Pham,...
-
[2013]
• Wang et al
to model the previously observed synthetic samples (Binici et al., 2022a). • Wang et al. (2024b) addresses the distribution shift between synthetic data and real training data. They propose a novel perspective with causal inference (V on K¨ugelgen et al., 2021; Sch¨olkopf et a...
2024
-
[2015]
Domain-adversarial training of neural networks
Ganin, Y ., Ustinova, E., Ajakan, H., Germain, P., Larochelle, H., Laviolette, F., Marchand, M., and Lempitsky, V . Domain-adversarial training of neural networks. The Journal of Machine Learning Research, 17(1):2096–2030,
-
[2016]
J., Shlens, J., and Szegedy, C
Goodfellow, I. J., Shlens, J., and Szegedy, C. Explain- ing and harnessing adversarial examples. arXiv preprint arXiv:1412.6572,
-
[2019]
Mosaicking to distill: Knowledge distillation from out-of-domain data
Fang, G., Bao, Y ., Song, J., Wang, X., Xie, D., Shen, C., and Song, M. Mosaicking to distill: Knowledge distillation from out-of-domain data. Advances in Neural Informa- tion Processing Systems, 34:11920–11932, 2021a. Fang, G., Song, J., Wang, X., Shen, C., Wang, X., and Song...
-
[2020]
Data- free knowledge transfer: A survey
Liu, Y ., Zhang, W., Wang, J., and Wang, J. Data- free knowledge transfer: A survey. arXiv preprint arXiv:2112.15278, 2021b. Luo, L., Sandler, M., Lin, Z., Zhmoginov, A., and Howard, A. Large-scale generative data-free distillation. arXiv preprint arXiv:2012.05578,
2012 arXiv
-
[2021]
Kingma, D. P. and Welling, M. Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114,
-
[2022]
Data-free adversarial distillation
Fang, G., Song, J., Shen, C., Wang, X., Chen, D., and Song, M. Data-free adversarial distillation. arXiv preprint arXiv:1912.11006,
1912 arXiv
-
[2023]
Your transferability barrier is fragile: Free-lunch for transferring the non-transferable learning
10 When Data-Free Knowledge Distillation Meets Non-Transferable Teacher: Escaping Out-of-Distribution Trap is All You Need Hong, Z., Shen, L., and Liu, T. Your transferability barrier is fragile: Free-lunch for transferring the non-transferable learning. In Proceedings of the ...
-
[2024]
Targeted backdoor attacks on deep learning systems using data poisoning
Chen, X., Liu, C., Li, B., Lu, K., and Song, D. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526,
-
[2025]
Exploring and exploiting decision boundary dynamics for adversarial robustness
Xu, Y ., Sun, Y ., Goldblum, M., Goldstein, T., and Huang, F. Exploring and exploiting decision boundary dynamics for adversarial robustness. arXiv preprint arXiv:2302.03015,
Reviewed August 6, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.